The explosive growth in the use of portable intelligent devices and network appliances has created demand for security mechanisms to be deployed which takes advantage of the greater user flexibility offered by these device. An ideal use for these devices is to simplify access to one or more computer systems in which a user may be required to interact with. For example, in an enterprise computing environment, a typical user may have a computer system which is used at a primary work location and a laptop which is used while the user is traveling.
In many cases, different user credentials are required to access the computer system and the laptop as a defensive measure for preventing cascading security compromises. Furthermore, the practice of using static user names and passwords has fallen into disfavor as this type of user credentials are frequently compromised, temporarily forgotten and increases administrative expenses by requiring a “helpdesk” type arrangement to assist users whose user names and passwords have either been forgotten or compromised.
A more secure solution is to provide a portable security device such as a security token which minimizes the number of credentials a user is required to remember and provides a much more secure mechanism to authenticate the user to a computer system. However, equipping each computer system with a separate security token, reader and interface software can be expensive to deploy and maintain, thus presenting a formidable economic barrier to improving computer system security over the use of static user names and passwords.
One possible solution is to provide an alternate mechanism for authenticating to one or more computer systems which minimizes the number security tokens, readers and interface software required to be installed and maintained. An example of which is shown in European patent application EP 1061482 A1 to Cuong. The Cuong application discloses an intelligent portable device which allows a user to authenticate to a plurality of financial service providers using a single universal security token in the form of a smart card. The basic goal of this application is to reduce the number of smart cards required to be carried by the user.
Another solution is disclosed in U.S. Pat. No. 6,016,476 to Maes, et. al. The Maes patent discloses an intelligent portable device for use by a consumer for point of sales and other financial transactions using the same concept of a single universal security token in the form of a smart card. This patent addresses security mechanisms such as biometric authentication to prevent unauthorized access to the user's universal security token.
Both the Cuong application and the Maes, et al. patent are intended to be used over a public network in a client-server arrangement where the user is authenticating to a external organization rather than there own organization. No particular emphasis is placed on the security of the telecommunications link.
In yet another approach, U.S. patent application Ser. No. 09/880,795 to Audebert, et al., provides a solution which may be implemented over a public or private network using a client-server and/or a peer-to-peer authentication arrangement. This application addresses the limitations described above but does not address security issues related to wireless telecommunications links or alternate user login mechanisms associated with accessing the user's unattended computer system. This application is to a common assignee and is not admitted as prior art to the instant application.
In the relevant art, it has been determined that certain of the earlier wireless security protocols could be compromised by a reasonably sophisticated attacker. For example, the wireless equivalent privacy (WEP) specified by the IEEE 802.11:1999 standard was intended to provide roughly the same level of confidentiality for wireless data that is available in a wired (Ethernet) LAN which is not protected by encryption. Later versions of the IEEE 802.11 standards have improved the level of security of wireless connections. However, total reliance on developing security protocols is not advisable. As such, additional security measures should be provided to ensure that authenticating information is not compromised or vulnerable to “man-in-the-middle,” “dictionary” or “replay” type attacks.
Lastly, a secure mechanism needs to be established which allows a user to authenticate to his or her computer system which does not require significant changes to existing user authentication mechanisms included in computer operating systems and does not reduce the overall level of security afforded by the existing authentication mechanisms.
Therefore, a secure authentication arrangement which allows an intelligent remote device to emulate a local security device peripheral in a peer-to-peer relationship over a private network without reduction in the overall level of security would be highly advantageous in current enterprise computing environments.